Goals of This Presentation• Introduce L4 microkernel principles and concepts– from “Microkernel Construction”http://os.inf.tu-dresden.de/Studium/MkK/– From "Microkernel-based Operating Systems"http://www.inf.tu-dresden.de/index.php?node_id=1314• Understand the real world usage for microkernels• Explore the modern implementation of modern L4microkernel
Agenda• Background Knowledge• Microkernel-based Operating Systems• Case Study
Microkernel Concepts• Minimal kernel and hardware enforce separation• Only kernel runs in CPU privileged mode• Components are user!level processes• No restrictions on component software• Reuse of legacy software
principle of least privilege (POLA)A capability is a communicable, unforgeable token of authority. It refers to a value thatreferences an object along with an associated set of access rights. A user program on acapability-based operating system must use a capability to access an object.
Case Study: Bugs inside big kernels• Drivers cause 85% of Windows XP crashes.– Michael M. Swift, Brian N. Bershad, Henry M. Levy: “Improving theReliability of Commodity Operating Systems”, SOSP 2003• Error rate in Linux drivers is 3x (maximum: 10x)– Andy Chou, Junfeng Yang, Benjamin Chelf, Seth Hallem, Dawson R.Engler: “An Empirical Study of Operating System Errors”, SOSP 2001• Causes for driver bugs– 23% programming error– 38% mismatch regarding device specification– 39% OS-driver-interface misconceptions– Leonid Ryzhyk, Peter Chubb, Ihor Kuz and Gernot Heiser: “Dingo:Taming device drivers”, EuroSys 2009
Microkernel• Minimalist approach– IPC, virtual memory, thread scheduling• Put the rest into user space– Device drivers, networking, file system, user interface• Disadvantages– Lots of system calls and context switches• Examples: Mach, L4, QNX, MINIX, IBM K42
3 Generations of Microkernel• Mach (1985-1994)– replace pipes with IPC (more general) – improved stability (vs monolithic kernels)– poor performance• L3 & L4 (1990-2001)– order of magnitude improvement in IPC performance• written in assembly, sacrificed CPU portability• only synchronus IPC (build async on top of sync) – very small kernel: more functions moved to userspace• seL4, Fiasco.OC, Coyotos, NOVA (2000-)– platform independence– verification, security, multiple CPUs, etc.
L4 Family (incomplete)Source: Microkernel-based Operating Systems – Introduction,Carsten Weinhold, TU Dresden (2012)
L4 API vs. ABI• L4 project was originally established by JochenLiedtke in the 1990s and is actively researched by theL4Ka team at the University of Karlsruhe incollaboration with NICTA / University of New SouthWales and the Dresden University of Technology.• L4 is defined by a platform-independent1 API and aplatform-dependent ABI
Apply Fiasco.OC for ARM• Mission: To implement a software stack that allows theemulation of the mobile operating system to use thefunctionality of hardware protection mechanisms• Essential components– ARM TrustZone extension– Fiasco.OC microkernel– Android
ARM TrustZone• ARM’s processor extension that allows for a softwareTPM implementation• Available on all major ARM mobile phone SoC• There is limited open source development withTrustZone
ARM TrustZone: Application Examples• Secure PIN Entry• Digital Rights Management• e-Ticketing Mobile TV (Netflix)
Trust Platform Module (TPM)• A TPM is a chip that resides on the motherboard, andprovides 4 basic functionalities– Secure storage and reporting of platformconfigurations– Protected private key storage– Cryptographic functions– Initialization and management functions
System OverviewThe highest part of the stack willbe a program we write that usesTrustZone’s TPM featuresApplication will makeTrustZone calls to themicrokernel
TPM Design Goals• use the secure world to provide two TPM services:– Random Number Generation– RSA Key Generation• An Android application will be able to use the TPMservices provided and will be able to perform thefollowing tasks:– encrypt sensitive data using the secure world– decrypt sensitive data using the secure world
Reference• From L3 to seL4: What Have We Learnt in 20 Years ofL4 Microkernels? Kevin Elphinstone and GernotHeiser, NICTA/UNSW• Microkernel Construction"http://os.inf.tu-dresden.de/Studium/MkK/• Microkernel-based Operating Systemshttp://www.inf.tu-dresden.de/index.php?node_id=1314• The L4 Microkernel, Hermann Härtig, TechnischeUniversität Dresden• Microkernels, Arun Krishnamurthy, University ofCentral Florida